AWS AmazonS3 documentation change
Summary
Restructured replication configuration documentation with updated section headers, removed redundant notes, and added dedicated section for S3 Batch Operations permissions
Security assessment
Changes focus on improving IAM permission documentation structure and adding Batch Operations guidance. While related to security practices through IAM roles and permissions, there's no evidence of addressing a specific vulnerability. The changes enhance documentation of existing security features rather than patching issues.
Diff
diff --git a/AmazonS3/latest/userguide/setting-repl-config-perm-overview.md b/AmazonS3/latest/userguide/setting-repl-config-perm-overview.md index 871a500f2..f521409e0 100644 --- a//AmazonS3/latest/userguide/setting-repl-config-perm-overview.md +++ b//AmazonS3/latest/userguide/setting-repl-config-perm-overview.md @@ -5 +5 @@ -Step 1: Granting permissions to the IAM principal who's creating replication rulesStep 2: Creating an IAM role for Amazon S3 to assume(Optional) Step 3: Granting permissions when the source and destination buckets are owned by different AWS accounts(Optional) Step 4: Granting permissions to change replica ownership +Setting up permissions to create replication rulesCreating an IAM roleGranting permissions when the source and destination buckets are owned by different AWS accountsChanging replica ownershipGranting permissions for S3 Batch Operations @@ -11,3 +11 @@ When setting up live replication in Amazon S3, you must acquire the necessary pe - * You must grant the AWS Identity and Access Management (IAM) principal (user or role) who will be creating replication rules a certain set of permissions. - - * Amazon S3 needs permissions to replicate objects on your behalf. You grant these permissions by creating an IAM role and then specifying that role in your replication configuration. + * Amazon S3 needs permissions to replicate objects on your behalf. You grant these permissions by creating an AWS Identity and Access Management (IAM) role and then specifying that role in your replication configuration. @@ -20,4 +17,0 @@ When setting up live replication in Amazon S3, you must acquire the necessary pe -###### Note - -If you're using S3 Batch Operations to replicate objects on demand instead of setting up live replication, a different IAM role and policies are required for S3 Batch Replication. For a Batch Replication IAM role and policy examples, see [Configuring an IAM role for S3 Batch Replication](./s3-batch-replication-policies.html). - @@ -26 +20,3 @@ If you're using S3 Batch Operations to replicate objects on demand instead of se - * Step 1: Granting permissions to the IAM principal who's creating replication rules + * Setting up permissions to create replication rules + + * Creating an IAM role @@ -28 +24 @@ If you're using S3 Batch Operations to replicate objects on demand instead of se - * Step 2: Creating an IAM role for Amazon S3 to assume + * Granting permissions when the source and destination buckets are owned by different AWS accounts @@ -30 +26 @@ If you're using S3 Batch Operations to replicate objects on demand instead of se - * (Optional) Step 3: Granting permissions when the source and destination buckets are owned by different AWS accounts + * Changing replica ownership @@ -32 +28 @@ If you're using S3 Batch Operations to replicate objects on demand instead of se - * (Optional) Step 4: Granting permissions to change replica ownership + * Granting permissions for S3 Batch Operations @@ -37 +33 @@ If you're using S3 Batch Operations to replicate objects on demand instead of se -## Step 1: Granting permissions to the IAM principal who's creating replication rules +## Setting up permissions to create replication rules @@ -150 +146 @@ JSON -## Step 2: Creating an IAM role for Amazon S3 to assume +## Creating an IAM role @@ -156,4 +151,0 @@ This section explains the trust policy and the minimum required permissions poli -###### Note - -If you're using the console to create your replication configuration, we recommend that you skip this section and instead have the console create this IAM role and the necessary trust and permission policies for you. - @@ -289 +281 @@ The permissions described here are related to the minimum replication configurat -## (Optional) Step 3: Granting permissions when the source and destination buckets are owned by different AWS accounts +## Granting permissions when the source and destination buckets are owned by different AWS accounts @@ -343 +335 @@ If objects in the source bucket are tagged, note the following: - * If the source bucket owner grants Amazon S3 permission for the `s3:GetObjectVersionTagging` and `s3:ReplicateTags` actions to replicate object tags (through the IAM role), Amazon S3 replicates the tags along with the objects. For information about the IAM role, see Step 2: Creating an IAM role for Amazon S3 to assume. + * If the source bucket owner grants Amazon S3 permission for the `s3:GetObjectVersionTagging` and `s3:ReplicateTags` actions to replicate object tags (through the IAM role), Amazon S3 replicates the tags along with the objects. For information about the IAM role, see Creating an IAM role. @@ -397 +389,18 @@ Follow the prompts and enter the AWS account ID of the source bucket account, an -## (Optional) Step 4: Granting permissions to change replica ownership +## Changing replica ownership + +When different AWS accounts own the source and destination buckets, you can tell Amazon S3 to change the ownership of the replica to the AWS account that owns the destination bucket. For more information about owner override, see [Changing the replica owner](./replication-change-owner.html). + +## Granting permissions for S3 Batch Operations + +S3 Batch Replication provides you a way to replicate the following objects: + + * Objects that existed before a replication configuration was in place + + * Objects that have previously been replicated + + * Objects that have failed replication + + + + +You can create a one-time Batch Replication job when creating the first rule in a new replication configuration or when adding a new destination to an existing configuration through the Amazon S3 console. You can also initiate Batch Replication for an existing replication configuration by creating a Batch Operations job. @@ -399 +408 @@ Follow the prompts and enter the AWS account ID of the source bucket account, an -When different AWS accounts own the source and destination buckets, you can tell Amazon S3 to change the ownership of the replica to the AWS account that owns the destination bucket. To override the ownership of replicas, you must either grant some additional permissions or adjust the S3 Object Ownership settings for the destination bucket. For more information about owner override, see [Changing the replica owner](./replication-change-owner.html). +For a Batch Replication IAM role and policy examples, see [Configuring an IAM role for S3 Batch Replication](./s3-batch-replication-policies.html).